1. INFORMATION ON THE PROCESSING OF PERSONAL DATA
Your data security is important to us and we are committed to handling your personal data responsibly. Below you can read how Envidan A/S and the other group companies (hereinafter “Envidan”, “we”, “us” or “our”) process personal data about you when we act as data controller. You can also read about your rights in relation to our processing operations.
2. ENVIDAN’S ROLE AS DATA CONTROLLER
In the course of running our business, we process a range of personal data. We do this so that we can provide you with the best possible service. We mainly collect and process ordinary (non-sensitive) personal data.
If you have any questions about our processing of your personal data, you can contact Envidan here:
Envidan A/S
CVR: 183 343 05
Vejlsøvej 23
8600 Silkeborg
Denmark
Chief Legal Officer and DPO:
Name: Birgitte Grønlund Møller
Telephone: +45 30 90 59 76
E-mail: bgm@envidan.dk
If you wish to contact us regarding our processing of your personal data, you can do so at
gdpr@envidan.dk
3. WHAT PERSONAL DATA WE COLLECT AND THE PURPOSE
We process personal data about you in a variety of situations. Read more about our treatment in the different situations below.
3.1. Visitors to Envidan websites and users of Envidan online services
When you visit Envidan’s websites (e.g. www.envidan.com) or use our other online services (e.g. LinkedIn, Facebook and Instagram), Envidan may process information about your IP address as well as information about your computer, device and browser.
We also process information about your visit (e.g. information about the way you enter our websites, how you navigate around them, which pages you visit, content you look at, your searches, advertisements you have seen, etc.) This personal data is collected through cookies, log files and other technologies (you can read more about our use of cookies here: https://www.envidan.com/compliance/cookie-policy/
We also process personal data that you provide to us in connection with your use of the website or our online services, for example when you use our online contact form, including your name, telephone number, email address, product interest, and other information you provide to us.
We use your personal data to enable us to make relevant products, supplies, benefits and services (“Services”) available to you and to improve your experience of our websites and online services and the Services we offer. We also use the personal data to show you content on our and other sites based on your activities and preferences, and to limit the number of times you see the same content.
Our basis for processing is our legitimate interests in making our website (and online services) available to you (GDPR Article 6(1)(f)) or your consent (GDPR Article 6(1)(a) and Cookie Order § 3).
We keep personal data collected in connection with your visit to our website for as long as they use our products or services or have an account with us, plus 5 years after entering into a customer relationship with us. Special circumstances or legal requirements may mean that this period may be shorter or longer, including for the purpose of complying with legal requirements for erasure or retention of data.
3.2. Customers
In order for you to be our customer, we need to collect the following personal data about you: name, username, address, email, phone number, CVR number, signature, location information.
We collect personal data about customers for the following purposes:
- Processing your purchase and providing our service
- Managing your relationship with us
We collect this information on the following legal bases:
- Processing is based on the performance of a contract with the customer and Envidan.
We keep the data for the time allowed by law and delete it when it is no longer needed. The period depends on the nature of the information and the reason for storage. Typically, customer data will be deleted after the end of the contract.
Information on customers is deleted 5 years after the end of the customer relationship.
3.3. Potential customers
In order for you to become our customer, we need to collect the following personal data about you: Name, company, e-mail, telephone number, address and CVR no.
We collect personal data of potential customers for the following purposes:
- Possible future cooperation or purchase transaction
- Managing your relationship with us
We collect this information on the following legal bases:
- The legitimate interest of the company in collecting and storing the data of the potential customers is to facilitate communication between the two parties. Only information that has been made public by the potential customer himself/herself is retained.
We keep the data for the time allowed by law and delete it when it is no longer needed. The period depends on the nature of the information and the reason for storing it. Typically, data relating to potential customers will be deleted after the termination of the contract or when the correspondence is considered no longer relevant. However, the data will be kept for the duration of the customer relationship.
Information on potential customers is deleted 2 years after the last contact or upon request.
3.4. Recipients of marketing
When you receive marketing, including newsletters from Envidan, we process personal data about your name, email address, product interest, title and telephone number. We also process information about your marketing or communication preferences, your use of the marketing we send you (including, for example, whether you have opened an email from us, whether the email has been read and which links you have opened), and information that you otherwise provide to us.
We process your personal data for the purposes of marketing our company and its services, setting up and managing you as a marketing subscriber. We use the personal data about your preferences and usage to understand the way our customers respond to our marketing and to improve marketing to you and our other customers in the future.
We will only send marketing material to you by email, text message or other electronic channel when we have obtained your consent to do so, where this is required under the rules of the Danish Marketing Practices Act.
We also use personal data about you to show you content on our and other sites based on your activities and preferences, to limit the number of times you see the same content, and to measure the effectiveness of our content and marketing. For this purpose, we may upload your email address to advertising tools such as Google or Facebook in order to send you targeted marketing.
Our basis for processing is our legitimate interests in complying with your wish to receive marketing from us, to which you have given consent under the Marketing Act (Article 6(1)(f) of the GDPR).
We keep personal data of marketing recipients for as long as the contact is active and the data subject has not withdrawn their consent. If the contact is inactive, personal data is kept for 2 years. If the data subject withdraws their consent, documentation of the original consent will be kept for 12 months from the date of withdrawal in accordance with the guidelines and requirements of the Consumer Ombudsman.
3.5. Participants in competitions
When you participate in competitions, we process personal data such as name, email address, phone number, answer to the relevant competition.
We process your personal data for the purposes of administering competitions, drawing winners, etc.
Our basis for processing is our legitimate interests in running the competition and contacting the winner (Article 6(1)(f) GDPR).
We keep the above information collected in connection with the organization of competitions for 2 years.
3.6. Participants at Envidan events
When you register and participate in events organized by Envidan, we process personal data about your name, phone number, email address, which event you are participating in.
We process this personal data for the administration of the event and for security reasons, as well as to send you relevant material.
Our basis for processing is our legitimate interests in organizing events (GDPR Article 6(1)(f)) or your consent (GDPR Article 6(1)(a) and Marketing Act § 10).
We keep personal data of event participants for 2 years after the end of the event. Information is then deleted.
3.7. Partners and/or suppliers to Envidan
When you are a business partner or supplier to Envidan or are a contact person at a business partner/supplier, we process personal data about your name, business address, work telephone number, e-mail address, title, as well as publicly available information and other information that you provide to us.
We process the personal data for contract management purposes as well as to receive goods and services from our suppliers and partners and, where relevant, to fulfill agreements with our customers.
Our basis for processing is the agreement with you (GDPR Article 6(1)(b)) or our legitimate interests in managing the relationship with you/the company you represent as a business partner/supplier (GDPR Article 6(1)(f)).
We keep the above information on partners and/or suppliers for up to 5 years after the end of the cooperation. The personal data will then be deleted.
3.8. Job applicants
Once we receive your application, it will be read and processed according to the following rules: The application and supporting documents will be shared internally with relevant staff in the recruitment process.
In the context of the recruitment process, Envidan may ask for a copy of a criminal record.
In addition, Envidan may ask candidates for selected positions to complete a personality test. The outcome of this will be considered by Envidan’s HR department and the relevant head of department.
Envidan uses the information to assess whether Envidan wishes to offer you employment and to communicate with you in connection with the recruitment process.
Your data is stored in Envidan’s HR system.
Only relevant managers, the HR department and IT administrators with personal passwords have access to your data.
If you become an employee of Envidan, your data will be stored in accordance with Envidan’s personal data policy for employees, which you can find on the Envidan intranet.
Personal data obtained in the recruitment process will be processed on the following processing basis: Consent; It is assumed that when the applicant discloses his/her data to Envidan, data is processed on the basis of the applicant’s consent, and the processing will stop at the time the consent is withdrawn.
As a general rule, applications from unsuccessful candidates are kept for 6 months after rejection. EnviDan obtains consent from the applicant for the storage of the application in the recruitment system.
During the application process, you have the possibility to consent to your data being stored in our subject bank for up to 12 months. This storage is only in case you do not get the job. You will be contacted before the end of the 12 months with the option to extend your consent for a further 12 months. If you have not given or renewed your consent, your data will be automatically deleted 6 months after you have been refused.
Envidan may in certain cases also disclose your personal data if required by law, court order or applicable legislation.
For unsolicited applications, we will keep your application and supporting documents for 6 months, after which they will be deleted. However, you have the possibility to consent to the application being stored for up to 12 months. You will be contacted before the end of the 12 months with the option to extend your consent for a further 12 months. If you have not given or renewed your consent, your data will be automatically deleted 6 months after you have been refused.
Your consent is voluntary and you can withdraw it at any time by contacting us using the contact details above.
4. SHARING YOUR PERSONAL DATA WITH OTHERS
Envidan may disclose your personal data to other suppliers and/or service providers in the ordinary course of our business and to our group companies.
Envidan may also disclose your personal data to a public authority in situations where we are specifically obliged to disclose your personal data pursuant to legislation and notification obligations to which we are subject.
We try to limit the disclosure of data in personally identifiable form and thus the disclosure of information that can be attributed to you personally.
Envidan also entrusts your personal data to data processors. Our data processors only process your personal data for our purposes and on our instructions.
5. TRANSFER OF PERSONAL DATA TO NON-EU/EEA COUNTRIES
In the context of our processing of your personal data, we may transfer the data to countries outside the EU/EEA (third countries).
Your personal data may be transferred to countries where the European Commission has assessed that the level of data protection is equivalent to the level of protection in the EU/EEA (safe third countries).
We may also transfer your personal data to unsecure third countries.
You can read more about the transfer of personal data outside the EU/EEA on the European Commission’s website.
If you would like further information about our transfer of personal data to countries outside the EU/EEA, please contact us.
6. STORAGE, DATA INTEGRITY AND SECURITY
When your personal data is no longer needed, we will ensure that it is deleted in a secure manner.
It is our policy to protect personal data by taking appropriate technical and organizational security measures.
We have implemented security measures to ensure data protection for all the personal data we process. We regularly carry out internal follow-ups on the adequacy of and compliance with policies and measures.
7. YOUR RIGHTS
As a data subject, you have a number of rights under the General Data Protection Regulation. If you want to exercise your rights, please contact us.
You can – unconditionally and at any time – withdraw any consent. You can do this by sending us an e-mail (see e-mail above). Withdrawal of your consent will not have any negative impact. However, this may mean that we will not be able to fulfill specific requests from you in the future. Withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal. Furthermore, it will not affect any processing carried out on a different lawful basis.
You can also object – unconditionally and at any time – to our processing when it is based on our legitimate interest.
Your rights also include the following:
Right of access:
You have the right to access the personal data we process about you.
Right to rectification:
You have the right to have inaccurate personal data concerning you rectified and incomplete personal data completed.
Right to erasure (right to be forgotten):
In special cases, you have the right to have personal data about you erased before the time when we would normally erase your personal data.
Right to restriction of processing:
In certain cases, you have the right to have the processing of your personal data restricted. If you have the right to restrict processing, we may in future only process the personal data – except for storage – with your consent, or for the establishment, exercise or defense of legal claims, or for the protection of a person or important public interests.
Right to object:
You have the right to object to our processing of your personal data in certain cases, and always if the processing is for direct marketing purposes.
Right to data portability:
In certain cases, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to have those personal data transmitted from one controller to another.
Right to lodge a complaint:
You can lodge a complaint with the Danish Data Protection Agency about our processing of personal data at any time. For more information, see www.datatilsynet.dk, where you can also find further information on your rights as a data subject.
8. UPDATING OUR PRIVACY POLICY
From time to time, it will be necessary for us to update this privacy policy. We regularly review our privacy policy to ensure that it is up to date, accurate and in line with applicable legislation and principles for the processing of personal data. We publish new versions on our website.
This policy has version no. 3.0 and is applicable from December 1, 2022.